ThinkCMF CVE-2026-111352

Requires a valid admin-type API token for a restricted/low-privilege backend administrator account - exploitation is NOT possible without this authenticated token (PR:L), so it cannot be triggered by a fully unauthenticated remote attacker. The specific trigger condition is a deployment where no 'admin_api' authorization rule is configured for the targeted endpoint, which causes Auth::check() in RestAdminBaseController to fail open and authorize the call; this is the default/common state rather than a rare misconfiguration, per the description. Limiting factors for defenders: the attacker must already possess or obtain a legitimate admin-tier API token, and the account must have REST API access enabled; the impact is confined to the ThinkCMF backend (SC:N/SI:N/SA:N - no scope change to other systems). Affected: ThinkCMF through 8.0.1.

This is a genuine, elevated-priority issue rather than a CVSS-inflated paper risk, but it is gated by a meaningful precondition. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the CWE-863 classification agree with the description: exploitation is network-reachable, low-complexity, requires no user interaction, but DOES require low privileges (PR:L) - specifically a valid admin-type API token belonging to a restricted/low-tier backend administrator. The VC:H/VI:H/VA:H impact is well-justified because the flaw lets such an account self-escalate via PUT admin/roles/{id}/authorize to full administrator, yielding complete confidentiality, integrity, and availability compromise of the backend (member PII exfiltration, member disabling, total admin takeover). No EPSS score, CISA KEV entry, or confirmed public exploit flag was supplied in the input, so there is no signal of active exploitation or automated mass-scanning; this currently reads as a high-impact-but-privilege-gated authorization flaw, not a widely-weaponized remote threat. The one notable caveat: a detailed third-party technical write-up (hackmd) and the exact vulnerable source lines are referenced, which lowers the barrier to developing a working exploit even though no packaged POC is confirmed. Net: prioritize for any ThinkCMF deployment that provisions non-superadmin API tokens, de-prioritize relative to unauthenticated RCEs.

A low-privileged backend administrator (or an attacker who has phished/stolen such an account's admin-type API token) authenticates to the ThinkCMF admin REST API. Because Auth::check() fails open when no admin_api rule is defined, the token is accepted for every admin endpoint, so the attacker calls PUT admin/roles/{id}/authorize to grant their own account full administrator rights and dumps member emails and mobile numbers. No public packaged exploit is confirmed, but a step-by-step technical write-up and the vulnerable source lines are publicly referenced, making exploitation straightforward.